CVE-2023-4973

LOWNuclei

Academy LMS GET Parameter filter cross site scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-4973 has a selected CVSS score of 3.5 (low); EIP currently links 1 Nuclei template.

Description

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 16, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

LMS

Browse Academy / LMS
CVE List6.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMAcademy LMS 6.2 - Cross-Site ScriptingCVSS 6.1

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely.

Impact

Unauthenticated attackers can inject malicious JavaScript via reflected XSS in search parameters, potentially stealing user session cookies or performing actions on behalf of users.

Remediation

Update Academy LMS to version 6.3 or later.

WeaknessesCWE-79
Authorsritikchaddha, princechaddha
Template tagspacketstormcve2023cveacademylmsxsscreativeitemvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:creativeitem:academy_lms:6.2:*:*:*:*:*:*:*
Shodan: html:"Academy LMS"
Shodan: http.html:"academy lms"
FOFA: body="Academy LMS"
FOFA: body="academy lms"
https://packetstormsecurity.com/files/174680/Academy-LMS-6.2-Cross-Site-Scripting.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4973

Source: ProjectDiscovery

References

4